Apps commonsguy: Tapjacking example

[surlac]

I'm trying out the example by Mark Murphy on Tapjacking, but the service doesn't receive any touch events.
I'm running it on API 18. Is this vulnerability closed in API 18? Or I misconfigured the project?

 

[surlac]

Answering myself. The vulnerability fixed in 4.0.3.